Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects PowerShell scripts that use the System.Net.WebClient class to download files or strings from the internet. This is a common technique used by adversaries to retrieve malicious payloads or additional tools.
Detects modifications to the Windows Package Manager (winget) administrative settings within the registry. This includes changes that could enable local manifest installations or disable installer hash checks, which might be abused by adversaries for defense evasion or persistence.
Detects when the CertOC.exe utility is used to download a file from a remote HTTP source. This behavior is indicative of an adversary using a living-off-the-land binary (LOLBIN) for ingress tool transfer.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') in conjunction with an 'http' string in the command line, indicating an attempt to download files from a remote HTTP source. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects the execution of SharpChisel, a .NET port of the Chisel tunneling tool, by monitoring process creation events for the executable name or product metadata. This tool can be used by adversaries to establish internal proxies for command and control traffic.
This rule detects the execution of a SILENTTRINITY stager by looking for the string 'st2stager' within the 'Description' field of process creation events. This string is typically found in the PE metadata of the stager executable, indicating its use.
Detects the usage of winget to add new additional download sources. Adversaries may abuse this functionality to introduce malicious package repositories, potentially leading to the download and execution of unauthorized software or tools.
Detects attempts to add an insecure (HTTP) download source to Winget. While Winget is designed to prevent the addition of insecure sources, this activity could indicate an attempt to bypass security controls or a user error. This rule specifically looks for the execution of 'winget.exe' with 'source add' and 'http://' in the command line.
This rule detects the usage of the Windows Package Manager (winget.exe) to install applications via a local manifest file. Adversaries can abuse winget to download and execute various types of payloads (e.g., .exe, .msi, .msix) from remote sources by providing a YAML manifest file directly to the client. This technique can be used for execution and defense evasion.
This rule detects when the `IMEWDBLD.exe` process initiates a network connection. This behavior is suspicious because `IMEWDBLD.exe` is a legitimate Microsoft Windows component (Input Method Editor Word Dictionary Builder) that is not typically expected to make outbound network connections. Adversaries may abuse this utility as a Living Off The Land Binary (LOLBIN) to download additional payloads or exfiltrate data, leveraging its trusted status to evade detection. The detection focuses on the initiation of any network connection by this specific executable.
Detects suspicious PowerShell commands that utilize 'System.Net.WebClient' to download files or strings from the internet. This technique is commonly used by adversaries for ingress tool transfer or to fetch additional malicious payloads.
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
This rule detects the execution of 'curl.exe' when it is used with the '-H' flag to specify a custom 'User-Agent' string. This behavior can be indicative of an attacker attempting to download or exfiltrate data to a domain that requires a specific User-Agent for access, potentially to bypass security controls or blend in with legitimate traffic. The rule specifically looks for the 'curl.exe' image or original filename and the presence of '-H' followed by 'User-Agent:' in the command line.
Detects the execution of 'GfxDownloadWrapper.exe' with a URL as a command-line argument, indicating an attempt to download a file. This utility is part of Intel Graphics Command Center and can be abused for ingress tool transfer.
Detects the execution of Htran or Htran-like tools such as NATBypass, identified by specific executable names or command-line arguments. These tools are commonly used for proxying network connections to obscure the origin of malicious traffic.
This rule detects the execution of the `netsh.exe` utility to configure a port forwarding rule specifically for RDP (port 3389). This technique can be used by adversaries to bypass network restrictions and establish RDP tunnels for lateral movement or command and control.
This rule detects suspicious PowerShell command-line patterns indicative of downloading and executing remote content. Specifically, it looks for the use of `IEX (New-Object Net.WebClient).DownloadString` or `(New-Object System.Net.WebClient).DownloadFile` which are commonly abused by malicious scripts, stagers, and downloaders to fetch and run payloads from the internet.
This rule detects when the 'EnableLocalManifestFiles' setting for AppInstaller (winget) is activated in the Windows Registry. Enabling this setting allows users to install new packages using custom manifests, which could be abused by adversaries to install malicious software or achieve persistence.
Detects a network connection initiated by the certutil.exe utility. Attackers can abuse this utility to download malware or additional payloads.
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. This behavior can be indicative of an adversary attempting to transfer tools or execute scripts from internal network shares.
This rule detects outbound network connections initiated by the Windows Script Host interpreters, wscript.exe or cscript.exe, to non-local IP addresses. This behavior is often indicative of adversaries using scripts to download additional malicious payloads or establish command and control. The rule filters out connections to common private and loopback IP ranges to reduce false positives.
Page 290 of 297